Privacy and Security Standards Flashcards

Which of the following best describes the 'minimum necessary' standard as it applies to CAC work?

Answer: CACs should collect only the minimum amount of consumer information needed to complete the specific assistance task

The minimum necessary standard requires CACs to limit collection, use, and disclosure of consumer information to only what is needed for the specific assistance being provided.

A CAC is helping a consumer update their Marketplace application on a public library computer. What is the most important security step before leaving?

Answer: Ensure the browser session is completely logged out and browsing history is cleared

On public computers, CACs must always log out of all accounts and clear session data to prevent unauthorized access to consumer information by subsequent users.

A consumer discloses that they are undocumented during an enrollment session. What privacy obligation does the CAC have regarding this information?

Answer: Keep it strictly confidential and use it only to determine the appropriate assistance

CACs must keep all consumer information, including immigration status, strictly confidential and may not share it with immigration enforcement agencies.

What should a CAC do if they receive a subpoena or legal order requesting consumer records?

Answer: Consult with their organization's legal counsel before responding to ensure proper compliance procedures are followed

Receiving a legal order for consumer records requires CAC organizations to consult legal counsel first to ensure proper processes are followed before any disclosure.

A CAC program uses a cloud-based application to store consumer records. Which security measure is most critical for protecting this data?

Answer: Ensuring the cloud provider has signed a data use agreement and meets federal security standards

Cloud vendors storing federal program consumer data must have a signed data use or business associate agreement and must meet applicable federal security requirements.

During a community enrollment event, a consumer asks a CAC to take photos of their documents (SSN card, pay stubs) on the CAC's personal cell phone. What should the CAC do?

Answer: Decline and use only approved organization devices or secure scanning equipment

Using personal devices to capture consumer PII is prohibited; only organization-approved, secured devices with proper data protection controls may be used.

A former consumer contacts a CAC organization requesting that their records be deleted. What is the organization's correct response?

Answer: Inform the consumer that records must be retained per federal requirements but explain their rights under applicable law

Federal record retention requirements may obligate the organization to retain records for a specified period regardless of deletion requests, though consumers must be informed of their rights.